Database recovery time objective optimization with synthetic snapshots

ABSTRACT

Methods and systems for reducing the amount of time to restore a database or other application by dynamically generating and storing synthetic snapshots are described. When backing up a database, an integrated data management and storage system may acquire snapshots of the database at a snapshot frequency and acquire database transaction logs at a frequency that is greater than the snapshot frequency. In response to detecting that the database is unable to provide a database snapshot, the integrated data management and storage system may generate a synthetic snapshot of the database by instantiating a compatible version of the database locally, acquiring a previously stored snapshot of the database, applying data changes from one or more database transaction logs to the previously stored snapshot to generate the synthetic snapshot, and storing the synthetic snapshot of the database within the integrated data management and storage system.

BACKGROUND

Virtualization allows virtual hardware to be created and decoupled fromthe underlying physical hardware. For example, a hypervisor running on ahost machine or server may be used to create one or more virtualmachines that may each run the same operating system or differentoperating systems (e.g., a first virtual machine may run a Windows®operating system and a second virtual machine may run a Unix-likeoperating system such as OS X®). A virtual machine may comprise asoftware implementation of a physical machine. The virtual machine mayinclude one or more virtual hardware devices, such as a virtualprocessor, a virtual memory, a virtual disk, or a virtual networkinterface card. The virtual machine may load and execute an operatingsystem and applications from the virtual memory. The operating systemand applications executed by the virtual machine may be stored using thevirtual disk. The virtual machine may be stored (e.g., using a datastorecomprising one or more physical storage devices) as a set of filesincluding a virtual disk file for storing the contents of the virtualdisk and a virtual machine configuration file for storing configurationsettings for the virtual machine. The configuration settings may includethe number of virtual processors (e.g., four virtual CPUs), the size ofa virtual memory, and the size of a virtual disk (e.g., a 2 TB virtualdisk) for the virtual machine.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1A depicts one embodiment of a networked computing environment.

FIG. 1B depicts one embodiment of a server.

FIG. 1C depicts one embodiment of a storage appliance.

FIG. 1D depicts one embodiment of a portion of an integrated datamanagement and storage system that includes a plurality of nodes incommunication with each other and one or more storage devices.

FIGS. 2A-2F depict various embodiments of sets of files and datastructures associated with managing and storing snapshots of virtualmachines.

FIG. 3A is a flowchart describing one embodiment of a process formanaging and storing virtual machine snapshots using a data storagesystem.

FIG. 3B is a flowchart describing one embodiment of a process fordetermining the type of snapshot to be stored using a data storagesystem.

FIG. 3C is a flowchart describing one embodiment of a process forrestoring a version of a virtual machine using a data storage system.

FIG. 4A depicts one embodiment of a data storage node running aplurality of database engines.

FIG. 4B depicts one embodiment of a server running a protected databasein communication with a data storage node.

FIG. 4C depicts one embodiment of various electronic files used by oneor more database engines to generate one or more synthetic snapshots.

FIG. 5A is a flowchart describing one embodiment of a process forgenerating and storing synthetic snapshots.

FIG. 5B is a flowchart describing another embodiment of a process forgenerating and storing synthetic snapshots.

DETAILED DESCRIPTION

Technology is described for reducing the amount of time to restore aparticular version of a database or other application (e.g., the amountof time required to restore the most recent point in time snapshot ofthe database) by dynamically generating and storing synthetic snapshots.When protecting or backing up a database, an integrated data managementand storage system may acquire snapshots of the database at a snapshotfrequency (e.g., every hour) and acquire database transaction logs thatinclude data changes of the database at a frequency that is greater thanthe snapshot frequency (e.g., every five minutes or every minute).Capturing both the database snapshots and the database transaction logs(or redo logs) for the database may allow the integrated data managementand storage system to restore any point in time version of the databasevia application of data changes within a subset of the databasetransaction logs to a particular snapshot of the database that isclosest to the restore point. One issue with obtaining the databasesnapshots from a production database is that the performance of thedatabase may be adversely impacted by the burden of having to providethe database snapshots, especially during times when the database isoverwhelmed with requests. In some cases, in response to detecting thata database is unable to provide a snapshot of the database at a secondpoint in time, the integrated data management and storage system maygenerate a synthetic snapshot of the database at the second point intime by instantiating a compatible version of the database locally,acquiring a previously stored snapshot of the database at a first pointin time prior to the second point in time, applying data changes fromone or more database transaction logs to the previously stored snapshotof the database to generate the synthetic snapshot of the database, andstoring the synthetic snapshot of the database within the integrateddata management and storage system. The benefits of generating andstoring synthetic snapshots locally when a production database is unableto provide a source-side snapshot include that the integrated datamanagement and storage system may maintain recovery time objectives(RTOs) with reduced burden on the production database and may use thesynthetic snapshots to reduce the number of database transaction logsthat need to be applied in order to restore a particular version of theproduction database.

In some cases, a storage appliance, such as storage appliance 170 inFIG. 1A, may detect that a production database is unable to provide adatabase snapshot of the database at a first point in time to thestorage appliance (e.g., as is required per a data backup policy) if theproduction database denies a request for the database snapshot, theproduction database fails to provide the database snapshot within athreshold period of time from the request for the database snapshot(e.g., the production database fails to provide the database snapshotwithin ten minutes from the request), or if the first point in time isduring a blackout window for the production database (e.g., a blackoutwindow between 4 pm and 6 pm every Monday) or during a predeterminedperiod of time during which the production database is unable to providethe database snapshot. In response to detecting that the productiondatabase is unable to provide the database snapshot, the storageappliance may identify a database engine that is compatible with thedatabase (e.g., a database engine within a pool of database engines withthe same version of the database or a version of the database with thesame compatibility level), run or instantiate the database enginelocally within the storage appliance, generate a synthetic snapshot ofthe database by acquiring one or more transaction logs for theproduction database and applying a subset of data changes within the oneor more transaction logs to a previously stored snapshot of theproduction database within the storage appliance, and store thesynthetic snapshot of the database within the storage appliance. In mostcases, acquiring database snapshots from the production database is amuch heavier resource drain on the host-side compared with transactionlog ingestion. The synthetic snapshot may be stored as a full imagesnapshot or an incremental snapshot within the storage appliance.

In one embodiment, a storage appliance may acquire an initial snapshotof a database from a server running the database, acquire databasetransaction logs for the database from the server subsequent toacquiring the initial snapshot of the database (e.g., receiving the logsevery minute), and generate and store synthetic snapshots of thedatabase (e.g., generating hourly synthetic snapshots of the database)without requiring another snapshot to be captured by the server afterthe initial snapshot. The storage appliance may generate the syntheticsnapshots using the initial snapshot, intermediary synthetic snapshotsof the database stored within the storage appliance, and the databasetransaction logs for the database. The synthetic snapshots may begenerated and stored to meet a maximum timing requirement (e.g., thatnot more than an hour of time separates consecutive snapshots). Thedatabase may comprise a relational database or a non-relational database(e.g., NoSQL).

A synthetic snapshot may refer to a snapshot of an application (e.g., adatabase application) at a particular point in time that is generatedlocally within a storage appliance without requiring the applicationitself to provide the snapshot of the application. The storage appliancemay generate and store one or more synthetic snapshots of a databaseduring a blackout window for the database in which snapshot acquisitionfrom the database is prohibited. The one or more synthetic snapshots maybe generated to adhere to a recovery point objective (e.g., that hourlysnapshots of the database are captured and stored even when the databaseis within a blackout window). The one or more synthetic snapshots mayalso be generated at a frequency that is higher than a snapshotfrequency for the database. For example, if a data backup policy for thedatabase requires that snapshots of the database be captured every hour,then synthetic snapshots between the hourly snapshots may be generatedand stored if a substantial number of data changes have occurred to thedatabase since the last hourly snapshot was captured. The storageappliance may instantiate a database engine to generate the one or moresynthetic snapshots and then terminate the database engine after the oneor more synthetic snapshots have been generated. The storage appliancemay maintain a pool of database engines running on nodes within acluster and schedule synthetic snapshot jobs based on the availabilityof the database engines within the pool. Each of the nodes within thecluster may run one or more database engines and the size of the pool ofdatabase engines may increase or decrease over time depending on thenumber of nodes within the cluster. The size of the pool of databaseengines may also increase or decrease over time depending on theavailable memory or disk space within each of the nodes. For example,each node may support one database engine per 500 GB of available diskspace.

In some embodiments, a storage appliance may generate a syntheticsnapshot of a database prior to the next scheduled snapshot of thedatabase if the storage appliance detects that a number of data changesthat have occurred to the database (or a particular table within thedatabase) since the most recent snapshot of the database is greater thana threshold number of data changes, that an aggregate file size for oneor more transaction logs associated with the data changes that occurredto the database since the most recent snapshot of the database wascaptured is greater than a threshold file size (e.g. that the combinedfile sizes of the one or more transaction logs is greater than 2 TB), orthat the total number of the one or more transaction logs since the mostrecent snapshot of the database is greater than a threshold number oflog files. The one or more transaction logs may comprise databasetransaction logs or redo logs for the database. The one or moretransaction logs may be acquired from a server running the database on aperiodic basis. In one example, the storage appliance may capture andstore database snapshots of the database every 24 hours and databasetransaction logs every five minutes; upon detection that the data changerate is above a threshold rate or that the combined file sizes for theone or more transaction logs is greater than a threshold file size, thestorage appliance may generate and store a synthetic snapshot associatedwith a point in time version of the database that is prior to the nextdaily snapshot of the database (e.g., the synthetic snapshot maycorrespond with a state of the database that is two hours after theprevious daily snapshot of the database).

In addition to generating synthetic snapshots, a database engine may beused to detect anomalies occurring within the database snapshots. In oneexample, if the number of updates to the database between consecutivesnapshots or the number of updates to a particular table associated withthe database exceeds a threshold number of updates, then the databaseengine may output an alert specifying that an anomaly has been detected.In some cases, database engines within a pool of database engines thatare not assigned to generating synthetic snapshots may be used toperform the anomaly detection. The anomaly detection may also beperformed while the synthetic snapshots are being generated by thedatabase engines or prior to the generation of the synthetic snapshots.

In response to an instruction from a hardware server to recover adatabase to a particular version of the database corresponding with aparticular point in time, a storage appliance may identify theclosest-in-time synthetic snapshot to the particular point in time andgenerate the particular version of the database by applying data changesfrom transaction logs to the closest-in-time synthetic snapshot. Thestorage appliance may then allow the hardware server to read theparticular version of the database and write data updates to theparticular version of the database. As an example, in response todetecting a database failure, an application running on the hardwareserver may temporarily use the storage appliance as a primary storagesystem for reading from and writing to the particular version of thedatabase. After the particular version of the database has beengenerated and stored, the storage appliance may share or transfer filesassociated with the particular version of the database to the hardwareserver or to an external application using the server message block(SMB) protocol or the network file system (NFS) protocol. The storageappliance may allow the hardware server or the external application towrite to the restored version of the database; in this case, thedatabase may act as a live mount database.

An integrated data management and storage system may be configured tomanage the automated storage, backup, deduplication, replication,recovery, and archival of data within and across physical and virtualcomputing environments. The integrated data management and storagesystem may provide a unified primary and secondary storage system withbuilt-in data management that may be used as both a backup storagesystem and a “live” primary storage system for primary workloads. Insome cases, the integrated data management and storage system may managethe extraction and storage of historical snapshots associated withdifferent point in time versions of virtual machines and/or realmachines (e.g., a hardware server, a laptop, a tablet computer, asmartphone, or a mobile computing device) and provide near instantaneousrecovery of a backed-up version of a virtual machine, a real machine, orone or more files residing on the virtual machine or the real machine.The integrated data management and storage system may allow backed-upversions of real or virtual machines to be directly mounted or madeaccessible to primary workloads in order to enable the nearinstantaneous recovery of the backed-up versions and allow secondaryworkloads (e.g., workloads for experimental or analytics purposes) todirectly use the integrated data management and storage system as aprimary storage target to read or modify past versions of data.

The integrated data management and storage system may include adistributed cluster of storage nodes that presents itself as a unifiedstorage system even though numerous storage nodes may be connectedtogether and the number of connected storage nodes may change over timeas storage nodes are added to or removed from the cluster. Theintegrated data management and storage system may utilize a scale-outnode based architecture in which a plurality of data storage appliancescomprising one or more nodes are in communication with each other viaone or more networks. Each storage node may include two or moredifferent types of storage devices and control circuitry configured tostore, deduplicate, compress, and/or encrypt data stored using the twoor more different types of storage devices. In one example, a storagenode may include two solid-state drives (SSDs), three hard disk drives(HDDs), and one or more processors configured to concurrently read datafrom and/or write data to the storage devices. The integrated datamanagement and storage system may replicate and distribute versioneddata, metadata, and task execution across the distributed cluster toincrease tolerance to node and disk failures (e.g., snapshots of avirtual machine may be triply mirrored across the cluster). Datamanagement tasks may be assigned and executed across the distributedcluster in a fault tolerant manner based on the location of data withinthe cluster (e.g., assigning tasks to nodes that store data related tothe task) and node resource availability (e.g., assigning tasks to nodeswith sufficient compute or memory capacity for the task).

The integrated data management and storage system may apply a databackup and archiving schedule to backed-up real and virtual machines toenforce various backup service level agreements (SLAs), recovery pointobjectives (RPOs), recovery time objectives (RTOs), data retentionrequirements, and other data backup, replication, and archival policiesacross the entire data lifecycle. For example, the data backup andarchiving schedule may require that snapshots of a virtual machine arecaptured and stored every four hours for the past week, every day forthe past six months, and every week for the past five years.

As virtualization technologies are adopted into information technology(IT) infrastructures, there is a growing need for recovery mechanisms tosupport mission critical application deployment within a virtualizedinfrastructure. However, a virtualized infrastructure may present a newset of challenges to the traditional methods of data management due tothe higher workload consolidation and the need for instant, granularrecovery. The benefits of using an integrated data management andstorage system include the ability to reduce the amount of data storagerequired to backup real and virtual machines, the ability to reduce theamount of data storage required to support secondary or non-productionworkloads, the ability to provide a non-passive storage target in whichbackup data may be directly accessed and modified, and the ability toquickly restore earlier versions of virtual machines and files storedlocally or in the cloud.

FIG. 1A depicts one embodiment of a networked computing environment 100in which the disclosed technology may be practiced. As depicted, thenetworked computing environment 100 includes a data center 150, astorage appliance 140, and a computing device 154 in communication witheach other via one or more networks 180. The networked computingenvironment 100 may include a plurality of computing devicesinterconnected through one or more networks 180. The one or morenetworks 180 may allow computing devices and/or storage devices toconnect to and communicate with other computing devices and/or otherstorage devices. In some cases, the networked computing environment mayinclude other computing devices and/or other storage devices not shown.The other computing devices may include, for example, a mobile computingdevice, a non-mobile computing device, a server, a workstation, a laptopcomputer, a tablet computer, a desktop computer, or an informationprocessing system. The other storage devices may include, for example, astorage area network storage device, a networked-attached storagedevice, a hard disk drive, a solid-state drive, or a data storagesystem. The one or more networks 180 may include a cellular network, amobile network, a wireless network, a wired network, a secure networksuch as an enterprise private network, an unsecure network such as awireless open network, a local area network (LAN), a wide area network(WAN), and the Internet.

The data center 150 may include one or more servers, such as server 160,in communication with one or more storage devices, such as storagedevice 156. The one or more servers may also be in communication withone or more storage appliances, such as storage appliance 170. Theserver 160, storage device 156, and storage appliance 170 may be incommunication with each other via a networking fabric connecting serversand data storage units within the data center to each other. The server160 may comprise a production hardware server. The storage appliance 170may include a data management system for backing up virtual machines,real machines, virtual disks, real disks, and/or electronic files withinthe data center 150. The server 160 may be used to create and manage oneor more virtual machines associated with a virtualized infrastructure.The one or more virtual machines may run various applications, such as adatabase application or a web server. The storage device 156 may includeone or more hardware storage devices for storing data, such as a harddisk drive (HDD), a magnetic tape drive, a solid-state drive (SSD), astorage area network (SAN) storage device, or a networked-attachedstorage (NAS) device. In some cases, a data center, such as data center150, may include thousands of servers and/or data storage devices incommunication with each other. The data storage devices may comprise atiered data storage infrastructure (or a portion of a tiered datastorage infrastructure). The tiered data storage infrastructure mayallow for the movement of data across different tiers of a data storageinfrastructure between higher-cost, higher-performance storage devices(e.g., solid-state drives and hard disk drives) and relativelylower-cost, lower-performance storage devices (e.g., magnetic tapedrives).

A server, such as server 160, may allow a client to download informationor files (e.g., executable, text, application, audio, image, or videofiles) from the server or to perform a search query related toparticular information stored on the server. In some cases, a server mayact as an application server or a file server. In general, a server mayrefer to a hardware device that acts as the host in a client-serverrelationship or a software process that shares a resource with orperforms work for one or more clients. One embodiment of server 160includes a network interface 165, processor 166, memory 167, disk 168,and virtualization manager 169 all in communication with each other.Network interface 165 allows server 160 to connect to one or morenetworks 180. Network interface 165 may include a wireless networkinterface and/or a wired network interface. Processor 166 allows server160 to execute computer readable instructions stored in memory 167 inorder to perform processes described herein. Processor 166 may includeone or more processing units, such as one or more CPUs and/or one ormore GPUs. Memory 167 may comprise one or more types of memory (e.g.,RAM, SRAM, DRAM, EEPROM, Flash, etc.). Disk 168 may include a hard diskdrive and/or a solid-state drive. Memory 167 and disk 168 may comprisehardware storage devices.

The virtualization manager 169 may manage a virtualized infrastructureand perform management operations associated with the virtualizedinfrastructure. For example, the virtualization manager 169 may managethe provisioning of virtual machines running within the virtualizedinfrastructure and provide an interface to computing devices interactingwith the virtualized infrastructure. The virtualization manager 169 mayalso perform various virtual machine related tasks, such as cloningvirtual machines, creating new virtual machines, monitoring the state ofvirtual machines, moving virtual machines between physical hosts forload balancing purposes, and facilitating backups of virtual machines.

One embodiment of storage appliance 170 includes a network interface175, processor 176, memory 177, and disk 178 all in communication witheach other. Network interface 175 allows storage appliance 170 toconnect to one or more networks 180. Network interface 175 may include awireless network interface and/or a wired network interface. Processor176 allows storage appliance 170 to execute computer readableinstructions stored in memory 177 in order to perform processesdescribed herein. Processor 176 may include one or more processingunits, such as one or more CPUs and/or one or more GPUs. Memory 177 maycomprise one or more types of memory (e.g., RAM, SRAM, DRAM, EEPROM, NORFlash, NAND Flash, etc.). Disk 178 may include a hard disk drive and/ora solid-state drive. Memory 177 and disk 178 may comprise hardwarestorage devices.

In one embodiment, the storage appliance 170 may include four machines.Each of the four machines may include a multi-core CPU, 64 GB of RAM, a400 GB SSD, three 4 TB HDDs, and a network interface controller. In thiscase, the four machines may be in communication with the one or morenetworks 180 via the four network interface controllers. The fourmachines may comprise four nodes of a server cluster. The server clustermay comprise a set of physical machines that are connected together viaa network. The server cluster may be used for storing data associatedwith a plurality of virtual machines, such as backup data associatedwith different point in time versions of one or more virtual machines.

In another embodiment, the storage appliance 170 may comprise a virtualappliance that comprises four virtual machines. Each of the virtualmachines in the virtual appliance may have 64 GB of virtual memory, a 12TB virtual disk, and a virtual network interface controller. In thiscase, the four virtual machines may be in communication with the one ormore networks 180 via the four virtual network interface controllers.The four virtual machines may comprise four nodes of a virtual cluster.

The networked computing environment 100 may provide a cloud computingenvironment for one or more computing devices. In one embodiment, thenetworked computing environment 100 may include a virtualizedinfrastructure that provides software, data processing, and/or datastorage services to end users accessing the services via the networkedcomputing environment. In one example, networked computing environment100 may provide cloud-based work productivity or business relatedapplications to a computing device, such as computing device 154. Thecomputing device 154 may comprise a mobile computing device or a tabletcomputer. The storage appliance 140 may comprise a cloud-based datamanagement system for backing up virtual machines and/or files within avirtualized infrastructure, such as virtual machines running on server160 or files stored on server 160.

In some embodiments, the storage appliance 170 may manage the extractionand storage of virtual machine snapshots associated with different pointin time versions of one or more virtual machines running within the datacenter 150. A snapshot of a virtual machine may correspond with a stateof the virtual machine at a particular point in time. In some cases, thesnapshot may capture the state of various virtual machine settings andthe state of one or more virtual disks for the virtual machine. Inresponse to a restore command from the server 160, the storage appliance170 may restore a point in time version of a virtual machine or restorepoint in time versions of one or more files located on the virtualmachine and transmit the restored data to the server 160. In response toa mount command from the server 160, the storage appliance 170 may allowa point in time version of a virtual machine to be mounted and allow theserver 160 to read and/or modify data associated with the point in timeversion of the virtual machine. To improve storage density, the storageappliance 170 may deduplicate and compress data associated withdifferent versions of a virtual machine and/or deduplicate and compressdata associated with different virtual machines. To improve systemperformance, the storage appliance 170 may first store virtual machinesnapshots received from a virtualized environment in a cache, such as aflash-based cache. The cache may also store popular data or frequentlyaccessed data (e.g., based on a history of virtual machinerestorations), incremental files associated with commonly restoredvirtual machine versions, and current day incremental files orincremental files corresponding with snapshots captured within the past24 hours.

An incremental file may comprise a forward incremental file or a reverseincremental file. A forward incremental file may include a set of datarepresenting changes that have occurred since an earlier point in timesnapshot of a virtual machine. To generate a snapshot of the virtualmachine corresponding with a forward incremental file, the forwardincremental file may be combined with an earlier point in time snapshotof the virtual machine (e.g., the forward incremental file may becombined with the last full image of the virtual machine that wascaptured before the forward incremental was captured and any otherforward incremental files that were captured subsequent to the last fullimage and prior to the forward incremental file). A reverse incrementalfile may include a set of data representing changes from a later pointin time snapshot of a virtual machine. To generate a snapshot of thevirtual machine corresponding with a reverse incremental file, thereverse incremental file may be combined with a later point in timesnapshot of the virtual machine (e.g., the reverse incremental file maybe combined with the most recent snapshot of the virtual machine and anyother reverse incremental files that were captured prior to the mostrecent snapshot and subsequent to the reverse incremental file).

The storage appliance 170 may provide a user interface (e.g., aweb-based interface or a graphical user interface) that displays virtualmachine information, such as identifications of the virtual machinesprotected and the historical versions or time machine views for each ofthe virtual machines protected, and allows an end user to search,select, and control virtual machines managed by the storage appliance. Atime machine view of a virtual machine may include snapshots of thevirtual machine over a plurality of points in time. Each snapshot maycomprise the state of the virtual machine at a particular point in time.Each snapshot may correspond with a different version of the virtualmachine (e.g., Version 1 of a virtual machine may correspond with thestate of the virtual machine at a first point in time and Version 2 ofthe virtual machine may correspond with the state of the virtual machineat a second point in time subsequent to the first point in time).

FIG. 1B depicts one embodiment of server 160 in FIG. 1A. The server 160may comprise one server out of a plurality of servers that are networkedtogether within a data center. In one example, the plurality of serversmay be positioned within one or more server racks within the datacenter. As depicted, the server 160 includes hardware-level componentsand software-level components. The hardware-level components include oneor more processors 182, one or more memory 184, and one or more disks185. The software-level components include a hypervisor 186, avirtualized infrastructure manager 199, and one or more virtualmachines, such as virtual machine 198. The hypervisor 186 may comprise anative hypervisor or a hosted hypervisor. The hypervisor 186 may providea virtual operating platform for running one or more virtual machines,such as virtual machine 198. Virtual machine 198 includes a plurality ofvirtual hardware devices including a virtual processor 192, a virtualmemory 194, and a virtual disk 195. The virtual disk 195 may comprise afile stored within the one or more disks 185. In one example, a virtualmachine may include a plurality of virtual disks, with each virtual diskof the plurality of virtual disks associated with a different filestored on the one or more disks 185. Virtual machine 198 may include aguest operating system 196 that runs one or more applications, such asapplication 197. The virtualized infrastructure manager 199, which maycorrespond with the virtualization manager 169 in FIG. 1A, may run on avirtual machine or natively on the server 160. The virtualizedinfrastructure manager 199 may provide a centralized platform formanaging a virtualized infrastructure that includes a plurality ofvirtual machines.

In one embodiment, the server 160 may use the virtualized infrastructuremanager 199 to facilitate backups for a plurality of virtual machines(e.g., eight different virtual machines) running on the server 160. Eachvirtual machine running on the server 160 may run its own guestoperating system and its own set of applications. Each virtual machinerunning on the server 160 may store its own set of files using one ormore virtual disks associated with the virtual machine (e.g., eachvirtual machine may include two virtual disks that are used for storingdata associated with the virtual machine).

In one embodiment, a data management application running on a storageappliance, such as storage appliance 140 in FIG. 1A or storage appliance170 in FIG. 1A, may request a snapshot of a virtual machine running onserver 160. The snapshot of the virtual machine may be stored as one ormore files, with each file associated with a virtual disk of the virtualmachine. A snapshot of a virtual machine may correspond with a state ofthe virtual machine at a particular point in time. The particular pointin time may be associated with a time stamp. In one example, a firstsnapshot of a virtual machine may correspond with a first state of thevirtual machine (including the state of applications and files stored onthe virtual machine) at a first point in time (e.g., 6:30 p.m. on Jun.29, 2017) and a second snapshot of the virtual machine may correspondwith a second state of the virtual machine at a second point in timesubsequent to the first point in time (e.g., 6:30 p.m. on Jun. 30,2017).

In response to a request for a snapshot of a virtual machine at aparticular point in time, the virtualized infrastructure manager 199 mayset the virtual machine into a frozen state or store a copy of thevirtual machine at the particular point in time. The virtualizedinfrastructure manager 199 may then transfer data associated with thevirtual machine (e.g., an image of the virtual machine or a portion ofthe image of the virtual machine) to the storage appliance. The dataassociated with the virtual machine may include a set of files includinga virtual disk file storing contents of a virtual disk of the virtualmachine at the particular point in time and a virtual machineconfiguration file storing configuration settings for the virtualmachine at the particular point in time. The contents of the virtualdisk file may include the operating system used by the virtual machine,local applications stored on the virtual disk, and user files (e.g.,images and word processing documents). In some cases, the virtualizedinfrastructure manager 199 may transfer a full image of the virtualmachine to the storage appliance or a plurality of data blockscorresponding with the full image (e.g., to enable a full image-levelbackup of the virtual machine to be stored on the storage appliance). Inother cases, the virtualized infrastructure manager 199 may transfer aportion of an image of the virtual machine associated with data that haschanged since an earlier point in time prior to the particular point intime or since a last snapshot of the virtual machine was taken. In oneexample, the virtualized infrastructure manager 199 may transfer onlydata associated with changed blocks stored on a virtual disk of thevirtual machine that have changed since the last snapshot of the virtualmachine was taken. In one embodiment, the data management applicationmay specify a first point in time and a second point in time and thevirtualized infrastructure manager 199 may output one or more changeddata blocks associated with the virtual machine that have been modifiedbetween the first point in time and the second point in time.

FIG. 1C depicts one embodiment of a storage appliance, such as storageappliance 170 in FIG. 1A. The storage appliance may include a pluralityof physical machines that may be grouped together and presented as asingle computing system. Each physical machine of the plurality ofphysical machines may comprise a node in a cluster (e.g., a failovercluster). As depicted, the storage appliance 170 includes hardware-levelcomponents and software-level components. The hardware-level componentsinclude one or more physical machines, such as physical machine 120 andphysical machine 130. The physical machine 120 includes a networkinterface 121, processor 122, memory 123, and disk 124 all incommunication with each other. Processor 122 allows physical machine 120to execute computer readable instructions stored in memory 123 toperform processes described herein. Disk 124 may include a hard diskdrive and/or a solid-state drive. The physical machine 130 includes anetwork interface 131, processor 132, memory 133, and disk 134 all incommunication with each other. Processor 132 allows physical machine 130to execute computer readable instructions stored in memory 133 toperform processes described herein. Disk 134 may include a hard diskdrive and/or a solid-state drive. In some cases, disk 134 may include aflash-based SSD or a hybrid HDD/SSD drive. In one embodiment, thestorage appliance 170 may include a plurality of physical machinesarranged in a cluster (e.g., eight machines in a cluster). Each of theplurality of physical machines may include a plurality of multi-coreCPUs, 128 GB of RAM, a 500 GB SSD, four 4 TB HDDs, and a networkinterface controller.

As depicted in FIG. 1C, the software-level components of the storageappliance 170 may include data management system 102, a virtualizationinterface 104, a distributed job scheduler 108, a distributed metadatastore 110, a distributed file system 112, and one or more virtualmachine search indexes, such as virtual machine search index 106. In oneembodiment, the software-level components of the storage appliance 170may be run using a dedicated hardware-based appliance. In anotherembodiment, the software-level components of the storage appliance 170may be run from the cloud (e.g., the software-level components may beinstalled on a cloud service provider).

In some cases, the data storage across a plurality of nodes in a cluster(e.g., the data storage available from the one or more physicalmachines) may be aggregated and made available over a single file systemnamespace (e.g., /snapshots/). A directory for each virtual machineprotected using the storage appliance 170 may be created (e.g., thedirectory for Virtual Machine A may be/snapshots/VM_A). Snapshots andother data associated with a virtual machine may reside within thedirectory for the virtual machine. In one example, snapshots of avirtual machine may be stored in subdirectories of the directory (e.g.,a first snapshot of Virtual Machine A may reside in/snapshots/VM_A/s1/and a second snapshot of Virtual Machine A may residein/snapshots/VM_A/s2/).

The distributed file system 112 may present itself as a single filesystem, in which as new physical machines or nodes are added to thestorage appliance 170, the cluster may automatically discover theadditional nodes and automatically increase the available capacity ofthe file system for storing files and other data. Each file stored inthe distributed file system 112 may be partitioned into one or morechunks. Each of the one or more chunks may be stored within thedistributed file system 112 as a separate file. The files stored withinthe distributed file system 112 may be replicated or mirrored over aplurality of physical machines, thereby creating a load-balanced andfault tolerant distributed file system. In one example, storageappliance 170 may include ten physical machines arranged as a failovercluster and a first file corresponding with a full-image snapshot of avirtual machine (e.g., /snapshots/VM_A/s1/s1.full) may be replicated andstored on three of the ten machines. In some cases, the data chunksassociated with a file stored in the distributed file system 112 mayinclude replicated data (e.g., due to n-way mirroring) or parity data(e.g., due to erasure coding). When a disk storing one of the datachunks fails, then the distributed file system may regenerate the lostdata and store the lost data using a new disk.

In one embodiment, the distributed file system 112 may be used to storea set of versioned files corresponding with a virtual machine. The setof versioned files may include a first file comprising a full image ofthe virtual machine at a first point in time and a second filecomprising an incremental file relative to the full image. The set ofversioned files may correspond with a snapshot chain for the virtualmachine. The distributed file system 112 may determine a first set ofdata chunks that includes redundant information for the first file(e.g., via application of erasure code techniques) and store the firstset of data chunks across a plurality of nodes within a cluster. Theplacement of the first set of data chunks within the cluster may bedetermined based on the locations of other data related to the first setof data chunks (e.g., the locations of other chunks corresponding withthe second file or other files within the snapshot chain for the virtualmachine). In some embodiments, the distributed file system 112 may alsoco-locate data chunks or replicas of virtual machines discovered to besimilar to each other in order to allow for cross virtual machinededuplication. In this case, the placement of the first set of datachunks may be determined based on the locations of other datacorresponding with a different virtual machine that has been determinedto be sufficiently similar to the virtual machine.

The distributed metadata store 110 may comprise a distributed databasemanagement system that provides high availability without a single pointof failure. The distributed metadata store 110 may act as a quick-accessdatabase for various components in the software stack of the storageappliance 170 and may store metadata corresponding with stored snapshotsusing a solid-state storage device, such as a solid-state drive (SSD) ora Flash-based storage device. In one embodiment, the distributedmetadata store 110 may comprise a database, such as a distributeddocument oriented database. The distributed metadata store 110 may beused as a distributed key value storage system. In one example, thedistributed metadata store 110 may comprise a distributed NoSQL keyvalue store database. In some cases, the distributed metadata store 110may include a partitioned row store, in which rows are organized intotables or other collections of related data held within a structuredformat within the key value store database. A table (or a set of tables)may be used to store metadata information associated with one or morefiles stored within the distributed file system 112. The metadatainformation may include the name of a file, a size of the file, filepermissions associated with the file, when the file was last modified,and file mapping information associated with an identification of thelocation of the file stored within a cluster of physical machines. Inone embodiment, a new file corresponding with a snapshot of a virtualmachine may be stored within the distributed file system 112 andmetadata associated with the new file may be stored within thedistributed metadata store 110. The distributed metadata store 110 mayalso be used to store a backup schedule for the virtual machine and alist of snapshots for the virtual machine that are stored using thestorage appliance 170.

In some cases, the distributed metadata store 110 may be used to manageone or more versions of a virtual machine. The concepts described hereinmay also be applicable to managing versions of a real machine orversions of electronic files. Each version of the virtual machine maycorrespond with a full image snapshot of the virtual machine storedwithin the distributed file system 112 or an incremental snapshot of thevirtual machine (e.g., a forward incremental or reverse incremental)stored within the distributed file system 112. In one embodiment, theone or more versions of the virtual machine may correspond with aplurality of files. The plurality of files may include a single fullimage snapshot of the virtual machine and one or more incrementalsderived from the single full image snapshot. The single full imagesnapshot of the virtual machine may be stored using a first storagedevice of a first type (e.g., a HDD) and the one or more incrementalsderived from the single full image snapshot may be stored using a secondstorage device of a second type (e.g., an SSD). In this case, only asingle full image needs to be stored and each version of the virtualmachine may be generated from the single full image or the single fullimage combined with a subset of the one or more incrementals.Furthermore, each version of the virtual machine may be generated byperforming a sequential read from the first storage device (e.g.,reading a single file from a HDD) to acquire the full image and, inparallel, performing one or more reads from the second storage device(e.g., performing fast random reads from an SSD) to acquire the one ormore incrementals. In some cases, a first version of a virtual machinecorresponding with a first snapshot of the virtual machine at a firstpoint in time may be generated by concurrently reading a full image forthe virtual machine corresponding with a state of the virtual machineprior to the first point in time from the first storage device whilereading one or more incrementals from the second storage devicedifferent from the first storage device (e.g., reading the full imagefrom a HDD at the same time as reading 64 incrementals from an SSD).

The distributed job scheduler 108 may comprise a distributed faulttolerant job scheduler, in which jobs affected by node failures arerecovered and rescheduled to be run on available nodes. In oneembodiment, the distributed job scheduler 108 may be fully decentralizedand implemented without the existence of a master node. The distributedjob scheduler 108 may run job scheduling processes on each node in acluster or on a plurality of nodes in the cluster and each node mayindependently determine which tasks to execute. The distributed jobscheduler 108 may be used for scheduling backup jobs that acquire andstore virtual machine snapshots for one or more virtual machines overtime. The distributed job scheduler 108 may follow a backup schedule tobackup an entire image of a virtual machine at a particular point intime or one or more virtual disks associated with the virtual machine atthe particular point in time.

The job scheduling processes running on at least a plurality of nodes ina cluster (e.g., on each available node in the cluster) may manage thescheduling and execution of a plurality of jobs. The job schedulingprocesses may include run processes for running jobs, cleanup processesfor cleaning up failed tasks, and rollback processes for rolling-back orundoing any actions or tasks performed by failed jobs. In oneembodiment, the job scheduling processes may detect that a particulartask for a particular job has failed and in response may perform acleanup process to clean up or remove the effects of the particular taskand then perform a rollback process that processes one or more completedtasks for the particular job in reverse order to undo the effects of theone or more completed tasks. Once the particular job with the failedtask has been undone, the job scheduling processes may restart theparticular job on an available node in the cluster.

The virtualization interface 104 may provide an interface forcommunicating with a virtualized infrastructure manager managing avirtualized infrastructure, such as the virtualized infrastructuremanager 199 in FIG. 1B, and for requesting data associated with virtualmachine snapshots from the virtualized infrastructure. Thevirtualization interface 104 may communicate with the virtualizedinfrastructure manager using an API for accessing the virtualizedinfrastructure manager (e.g., to communicate a request for a snapshot ofa virtual machine).

The virtual machine search index 106 may include a list of files thathave been stored using a virtual machine and a version history for eachof the files in the list. Each version of a file may be mapped to theearliest point in time snapshot of the virtual machine that includes theversion of the file or to a snapshot of the virtual machine thatincludes the version of the file (e.g., the latest point in timesnapshot of the virtual machine that includes the version of the file).In one example, the virtual machine search index 106 may be used toidentify a version of the virtual machine that includes a particularversion of a file (e.g., a particular version of a database, aspreadsheet, or a word processing document). In some cases, each of thevirtual machines that are backed up or protected using storage appliance170 may have a corresponding virtual machine search index.

The data management system 102 may comprise an application running onthe storage appliance that manages the capturing, storing,deduplication, compression (e.g., using a lossless data compressionalgorithm such as LZ4 or LZ77), and encryption (e.g., using a symmetrickey algorithm such as Triple DES or AES-256) of data for the storageappliance 170. In one example, the data management system 102 maycomprise a highest level layer in an integrated software stack runningon the storage appliance. The integrated software stack may include thedata management system 102, the virtualization interface 104, thedistributed job scheduler 108, the distributed metadata store 110, andthe distributed file system 112. In some cases, the integrated softwarestack may run on other computing devices, such as a server or computingdevice 154 in FIG. 1A. The data management system 102 may use thevirtualization interface 104, the distributed job scheduler 108, thedistributed metadata store 110, and the distributed file system 112 tomanage and store one or more snapshots of a virtual machine. Eachsnapshot of the virtual machine may correspond with a point in timeversion of the virtual machine. The data management system 102 maygenerate and manage a list of versions for the virtual machine. Eachversion of the virtual machine may map to or reference one or morechunks and/or one or more files stored within the distributed filesystem 112. Combined together, the one or more chunks and/or the one ormore files stored within the distributed file system 112 may comprise afull image of the version of the virtual machine.

In some embodiments, a plurality of versions of a virtual machine may bestored as a base file associated with a complete image of the virtualmachine at a particular point in time and one or more incremental filesassociated with forward and/or reverse incremental changes derived fromthe base file. The data management system 102 may patch together thebase file and the one or more incremental files in order to generate aparticular version of the plurality of versions by adding and/orsubtracting data associated with the one or more incremental files fromthe base file or intermediary files derived from the base file. In someembodiments, each version of the plurality of versions of a virtualmachine may correspond with a merged file. A merged file may includepointers or references to one or more files and/or one or more chunksassociated with a particular version of a virtual machine. In oneexample, a merged file may include a first pointer or symbolic link to abase file and a second pointer or symbolic link to an incremental fileassociated with the particular version of the virtual machine. In someembodiments, the one or more incremental files may correspond withforward incrementals (e.g., positive deltas), reverse incrementals(e.g., negative deltas), or a combination of both forward incrementalsand reverse incrementals.

FIG. 1D depicts one embodiment of a portion of an integrated datamanagement and storage system that includes a plurality of nodes incommunication with each other and one or more storage devices via one ormore networks 180. The plurality of nodes may be networked together andpresent themselves as a unified storage system. The plurality of nodesincludes node 141 and node 147. The one or more storage devices includestorage device 157 and storage device 158. Storage device 157 maycorrespond with a cloud-based storage (e.g., private or public cloudstorage). Storage device 158 may comprise a hard disk drive (HDD), amagnetic tape drive, a solid-state drive (SSD), a storage area network(SAN) storage device, or a networked-attached storage (NAS) device. Theintegrated data management and storage system may comprise a distributedcluster of storage appliances in which each of the storage appliancesincludes one or more nodes. In one embodiment, node 141 and node 147 maycomprise two nodes housed within a first storage appliance, such asstorage appliance 170 in FIG. 1C. In another embodiment, node 141 maycomprise a first node housed within a first storage appliance and node147 may comprise a second node housed within a second storage appliancedifferent from the first storage appliance. The first storage applianceand the second storage appliance may be located within a data center,such as data center 150 in FIG. 1A, or located within different datacenters.

As depicted, node 141 includes a network interface 142, a nodecontroller 143, and a first plurality of storage devices including HDDs144-145 and SSD 146. The first plurality of storage devices may comprisetwo or more different types of storage devices. The node controller 143may comprise one or more processors configured to store, deduplicate,compress, and/or encrypt data stored within the first plurality ofstorage devices. Node 147 includes a network interface 148, a nodecontroller 149, and a second plurality of storage devices including HDDs151-152 and SSD 153. The second plurality of storage devices maycomprise two or more different types of storage devices. The nodecontroller 149 may comprise one or more processors configured to store,deduplicate, compress, and/or encrypt data stored within the secondplurality of storage devices. In some cases, node 141 may correspondwith physical machine 120 in FIG. 1C and node 147 may correspond withphysical machine 130 in FIG. 1C.

FIGS. 2A-2F depict various embodiments of sets of files and datastructures (e.g., implemented using merged files) associated withmanaging and storing snapshots of virtual machines.

FIG. 2A depicts one embodiment of a set of virtual machine snapshotsstored as a first set of files. The first set of files may be storedusing a distributed file system, such as distributed file system 112 inFIG. 1C. As depicted, the first set of files includes a set of reverseincrementals (R1-R4), a full image (Base), and a set of forwardincrementals (F1-F2). The set of virtual machine snapshots includesdifferent versions of a virtual machine (versions V1-V7 of VirtualMachine A) captured at different points in time (times T1-T7). In somecases, the file size of the reverse incremental R3 and the file size ofthe forward incremental F2 may both be less than the file size of thebase image corresponding with version V5 of Virtual Machine A. The baseimage corresponding with version V5 of Virtual Machine A may comprise afull image of Virtual Machine A at point in time T5. The base image mayinclude a virtual disk file for Virtual Machine A at point in time T5.The reverse incremental R3 corresponds with version V2 of VirtualMachine A and the forward incremental F2 corresponds with version V7 ofVirtual Machine A. The forward incremental F1 may be associated with thedata changes that occurred to Virtual Machine A between time T5 and timeT6 and may comprise one or more changed data blocks.

In some embodiments, each snapshot of the set of virtual machinesnapshots may be stored within a storage appliance, such as storageappliance 170 in FIG. 1A. In other embodiments, a first set of the setof virtual machine snapshots may be stored within a first storageappliance and a second set of the set of virtual machine snapshots maybe stored within a second storage appliance, such as storage appliance140 in FIG. 1A. In this case, a data management system may extend acrossboth the first storage appliance and the second storage appliance. Inone example, the first set of the set of virtual machine snapshots maybe stored within a local cluster repository (e.g., recent snapshots ofthe file may be located within a first data center) and the second setof the set of virtual machine snapshots may be stored within a remotecluster repository (e.g., older snapshots or archived snapshots of thefile may be located within a second data center) or a cloud repository.

FIG. 2B depicts one embodiment of a merged file for generating versionV7 of Virtual Machine A using the first set of files depicted in FIG.2A. The merged file includes a first pointer (pBase) that references thebase image Base (e.g., via the path /snapshots/VM_A/s5/s5.full), asecond pointer (pF1) that references the forward incremental F1 (e.g.,via the path/snapshots/VM_A/s6/s6.delta), and a third pointer (pF2) thatreferences the forward incremental F2 (e.g., via thepath/snapshots/VM_A/s7/s7.delta). In one embodiment, to generate thefull image of version V7 of Virtual Machine A, the base image may beacquired, the data changes associated with forward incremental F1 may beapplied to (or patched to) the base image to generate an intermediateimage, and then the data changes associated with forward incremental F2may be applied to the intermediate image to generate the full image ofversion V7 of Virtual Machine A.

FIG. 2C depicts one embodiment of a merged file for generating versionV2 of Virtual Machine A using the first set of files depicted in FIG.2A. The merged file includes a first pointer (pBase) that references thebase image Base (e.g., via the path /snapshots/VM_A/s5/s5.full), asecond pointer (pR1) that references the reverse incremental R1 (e.g.,via the path/snapshots/VM_A/s4/s4.delta), a third pointer (pR2) thatreferences the reverse incremental R2 (e.g., via thepath/snapshots/VM_A/s3/s3.delta), and a fourth pointer (pR3) thatreferences the reverse incremental R3 (e.g., via thepath/snapshots/VM_A/s2/s2.delta). In one embodiment, to generate thefull image of version V2 of Virtual Machine A, the base image may beacquired, the data changes associated with reverse incremental R1 may beapplied to the base image to generate a first intermediate image, thedata changes associated with reverse incremental R2 may be applied tothe first intermediate image to generate a second intermediate image,and then the data changes associated with reverse incremental R3 may beapplied to the second intermediate image to generate the full image ofversion V2 of Virtual Machine A.

FIG. 2D depicts one embodiment of a set of virtual machine snapshotsstored as a second set of files after a rebasing process has beenperformed using the first set of files in FIG. 2A. The second set offiles may be stored using a distributed file system, such as distributedfile system 112 in FIG. 1C. The rebasing process may generate new filesR12, R11, and Base2 associated with versions V5-V7 of Virtual Machine Ain order to move a full image closer to a more recent version of VirtualMachine A and to improve the reconstruction time for the more recentversions of Virtual Machine A. The data associated with the full imageBase in FIG. 2A may be equivalent to the new file R12 patched over R11and the full image Base2. Similarly, the data associated with the fullimage Base2 may be equivalent to the forward incremental F2 in FIG. 2Apatched over F1 and the full image Base in FIG. 2A.

The process of moving the full image snapshot for the set of virtualmachine snapshots to correspond with the most recent snapshot versionmay be performed in order to shorten or reduce the chain lengths for thenewest or most recent snapshots, which may comprise the snapshots ofVirtual Machine A that are the most likely to be accessed. In somecases, a rebasing operation (e.g., that moves the full image snapshotfor a set of virtual machine snapshots to correspond with the mostrecent snapshot version) may be triggered when a number of forwardincremental files is greater than a threshold number of forwardincremental files for a snapshot chain (e.g., more than 200 forwardincremental files). In other cases, a rebasing operation may betriggered when the total disk size for the forward incremental filesexceeds a threshold disk size (e.g., is greater than 200 GB) or isgreater than a threshold percentage (e.g., is greater than 20%) of thebase image for the snapshot chain.

In some cases, the rebasing process may be part of a periodic rebasingprocess that is applied at a rebasing frequency (e.g., every 24 hours)to each virtual machine of a plurality of protected virtual machines toreduce the number of forward incremental files that need to be patchedto a base image in order to restore the most recent version of a virtualmachine. Periodically reducing the number of forward incremental filesmay reduce the time to restore the most recent version of the virtualmachine as the number of forward incremental files that need to beapplied to a base image to generate the most recent version may belimited. In one example, if a rebasing process is applied to snapshotsof a virtual machine every 24 hours and snapshots of the virtual machineare acquired every four hours, then the number of forward incrementalfiles may be limited to at most five forward incremental files.

As depicted, the second set of files includes a set of reverseincrementals (R11-R12 and R1-R4) and a full image (Base2). The set ofvirtual machine snapshots includes the different versions of the virtualmachine (versions V1-V7 of Virtual Machine A) captured at the differentpoints in time (times T1-T7) depicted in FIG. 2A. In some cases, thefile size of the reverse incremental R2 may be substantially less thanthe file size of the base image Base2. The reverse incremental R2corresponds with version V2 of Virtual Machine A and the base imageBase2 corresponds with version V7 of Virtual Machine A. In this case,the most recent version of Virtual Machine A (i.e., the most recentrestore point for Virtual Machine A) comprises a full image. To generateearlier versions of Virtual Machine A, reverse incrementals may beapplied to (or patched to) the full image Base2. Subsequent versions ofVirtual Machine A may be stored as forward incrementals that depend fromthe full image Base2.

In one embodiment, a rebasing process may be applied to a first set offiles associated with a virtual machine in order to generate a secondset of files to replace the first set of files. The first set of filesmay include a first base image from which a first version of the virtualmachine may be derived and a first forward incremental file from which asecond version of the virtual machine may be derived. The second set offiles may include a second reverse incremental file from which the firstversion of the virtual machine may be derived and a second base imagefrom which the second version of the virtual machine may be derived.During the rebasing process, data integrity checking may be performed todetect and correct data errors in the files stored in a file system,such as distributed file system 112 in FIG. 1C, that are read togenerate the second set of files.

FIG. 2E depicts one embodiment of a merged file for generating versionV7 of Virtual Machine A using the second set of files depicted in FIG.2D. The merged file includes a first pointer (pBase2) that referencesthe base image Base2 (e.g., via the path /snapshots/VM_A/s7/s7.full). Inthis case, the full image of version V7 of Virtual Machine A may bedirectly acquired without patching forward incrementals or reverseincrementals to the base image Base2 corresponding with version V7 ofVirtual Machine A.

FIG. 2F depicts one embodiment of a merged file for generating versionV2 of Virtual Machine A using the second set of files depicted in FIG.2D. The merged file includes a first pointer (pBase2) that referencesthe base image Base2 (e.g., via the path /snapshots/VM_A/s7/s7.full), asecond pointer (pR11) that references the reverse incremental R11 (e.g.,via the path/snapshots/VM_A/s6/s6.delta), a third pointer (pR12) thatreferences the reverse incremental R12 (e.g., via thepath/snapshots/VM_A/s5/s5.delta), a fourth pointer (pR1) that referencesthe reverse incremental R1 (e.g., via thepath/snapshots/VM_A/s4/s4.delta), a fifth pointer (pR2) that referencesthe reverse incremental R2 (e.g., via the path/snapshots/VM_A/s3/s3.delta), and a sixth pointer (pR3) that referencesthe reverse incremental R3 (e.g., via thepath/snapshots/VM_A/s2/s2.delta). In one embodiment, to generate thefull image of version V2 of Virtual Machine A, the base image may beacquired, the data changes associated with reverse incremental R11 maybe applied to the base image to generate a first intermediate image, thedata changes associated with reverse incremental R12 may be applied tothe first intermediate image to generate a second intermediate image,the data changes associated with reverse incremental R1 may be appliedto the second intermediate image to generate a third intermediate image,the data changes associated with reverse incremental R2 may be appliedto the third intermediate image to generate a fourth intermediate image,and then the data changes associated with reverse incremental R3 may beapplied to the fourth intermediate image to generate the full image ofversion V2 of Virtual Machine A.

FIG. 3A is a flowchart describing one embodiment of a process formanaging and storing virtual machine snapshots using a data storagesystem. In one embodiment, the process of FIG. 3A may be performed by astorage appliance, such as storage appliance 170 in FIG. 1A.

In step 302, a schedule for backing up a first virtual machine isdetermined. In one example, the schedule for backing up the firstvirtual machine may comprise periodically backing up the first virtualmachine every four hours. The schedule for backing up the first virtualmachine may be derived from a new backup, replication, and archivalpolicy or backup class assigned to the first virtual machine. In step304, a job scheduler is configured to implement the schedule for backingup the first virtual machine. In one example, a distributed jobscheduler, such as distributed job scheduler 108 in FIG. 1C, may beconfigured to schedule and run processes for capturing and storingimages of the first virtual machine over time according the schedule. Instep 306, a snapshot process for acquiring a snapshot of the firstvirtual machine is initiated. The snapshot process may send aninstruction to a virtualized infrastructure manager, such asvirtualization manager 169 in FIG. 1A, that requests data associatedwith the snapshot of the first virtual machine. In step 308, a type ofsnapshot to be stored is determined. The type of snapshot may comprise afull image snapshot or an incremental snapshot. In some cases, a fullimage snapshot may be captured and stored in order to serve as an anchorsnapshot for a new snapshot chain. Versions of the first virtual machinemay be stored using one or more independent snapshot chains, whereineach snapshot chain comprises a full image snapshot and one or moreincremental snapshots. One embodiment of a process for determining thetype of snapshot to be stored (e.g., storing either a full imagesnapshot or an incremental snapshot) is described later in reference toFIG. 3B.

In step 310, it is determined whether a full image of the first virtualmachine needs to be stored in order to store the snapshot of the firstvirtual machine. The determination of whether a full image is requiredmay depend on whether a previous full image associated with a priorversion of the first virtual machine has been acquired. Thedetermination of whether a full image is required may depend on thedetermination of the type of snapshot to be stored in step 308. If afull image needs to be stored, then step 311 is performed. Otherwise, ifa full image does not need to be stored, then step 312 is performed. Instep 311, the full image of the first virtual machine is acquired. Thefull image of the first virtual machine may correspond with a file orone or more data chunks. In step 312, changes relative to a priorversion of the first virtual machine or relative to another virtualmachine (e.g., in the case that the first virtual machine comprises adependent virtual machine whose snapshots derive from a full imagesnapshot of a second virtual machine different from the first virtualmachine) are acquired. The changes relative to the prior version of thefirst virtual machine or relative to a version of a different virtualmachine may correspond with a file or one or more data chunks. In step313, the full image of the first virtual machine is stored using adistributed file system, such as distributed file system 112 in FIG. 1C.In step 314, the changes relative to the prior version of the firstvirtual machine or relative to another virtual machine are stored usinga distributed file system, such as distributed file system 112 in FIG.1C. In one embodiment, the full image of the first virtual machine maybe stored using a first storage device of a first type (e.g., a HDD) andthe changes relative to the prior version of the first virtual machinemay be stored using a second storage device of a second type (e.g., anSSD).

In some embodiments, snapshots of the first virtual machine may beingested at a snapshot capture frequency (e.g., every 30 minutes) by adata storage system. When a snapshot of the first virtual machine isingested, the snapshot may be compared with other snapshots storedwithin the data storage system in order to identify a candidate snapshotfrom which the snapshot may depend. In one example, a scalableapproximate matching algorithm may be used to identify the candidatesnapshot whose data most closely matches the data associated with thesnapshot or to identify the candidate snapshot whose data has the fewestnumber of data differences with the snapshot. In another example, anapproximate matching algorithm may be used to identify the candidatesnapshot whose data within a first portion of the candidate snapshotmost closely matches data associated with a first portion of thesnapshot. In some cases, a majority of the data associated with thesnapshot and the candidate snapshot may be identical (e.g., both thesnapshot and the candidate snapshot may be associated with virtualmachines that use the same operating system and have the sameapplications installed). Once the candidate snapshot has beenidentified, then data differences (or the delta) between the snapshotand the candidate snapshot may be determined and the snapshot may bestored based on the data differences. In one example, the snapshot maybe stored using a forward incremental file that includes the datadifferences between the snapshot and the candidate snapshot. The forwardincremental file may be compressed prior to being stored within a filesystem, such as distributed file system 112 in FIG. 1C.

In step 316, a merged file associated with the snapshot is generated.The merged file may reference one or more files or one or more datachunks that have been acquired in either step 311 or step 312. In oneexample, the merged file may comprise a file or a portion of a file thatincludes pointers to the one or more files or the one or more datachunks. In step 318, the merged file is stored in a metadata store, suchas distributed metadata store 110 in FIG. 1C. In step 320, a virtualmachine search index for the first virtual machine is updated. Thevirtual machine search index for the first virtual machine may include alist of files that have been stored in the first virtual machine and aversion history for each of the files in the list. In one example, thevirtual machine search index for the first virtual machine may beupdated to include new files that have been added to the first virtualmachine since a prior snapshot of the first virtual machine was takenand/or to include updated versions of files that were previously storedin the first virtual machine.

FIG. 3B is a flowchart describing one embodiment of a process fordetermining the type of snapshot to be stored using a data storagesystem. The process described in FIG. 3B is one example of a process forimplementing step 308 in FIG. 3A. In one embodiment, the process of FIG.3B may be performed by a storage appliance, such as storage appliance170 in FIG. 1A.

In step 332, a snapshot chain for a first virtual machine is identified.The snapshot chain may comprise a full image snapshot for the firstvirtual machine and one or more incremental snapshots that derive fromthe full image snapshot. Backed-up versions of the first virtual machinemay correspond with one or more snapshot chains. Each of the one or moresnapshot chains may include a full image snapshot or a base image fromwhich incremental snapshots may derive.

In step 334, it is determined whether the snapshot chain includes adependent base file. In this case, the first virtual machine maycomprise a dependent virtual machine that has snapshots that derive froma full image snapshot of a different virtual machine. In one embodiment,the first virtual machine and the different virtual machine from whichthe first virtual machine depends may each have different virtualmachine configuration files for storing configuration settings for thevirtual machines. In one example, the first virtual machine may have afirst number of virtual processors (e.g., two processors) and thedifferent virtual machine may have a second number of virtual processorsdifferent from the first number of virtual processors (e.g., fourprocessors). In another example, the first virtual machine may have afirst virtual memory size (e.g., 1 GB) and the different virtual machinemay have a second virtual memory size different from the first virtualmemory size (e.g., 2 GB). In another example, the first virtual machinemay run a first guest operating system and the different virtual machinemay run a second guest operating system different from the first guestoperating system.

In step 336, a maximum incremental chain length for the snapshot chainis determined based on whether the snapshot chain includes a dependentbase file. In one example, if the first virtual machine comprises adependent virtual machine, then the maximum incremental chain length maybe set to a maximum length of 200 snapshots; however if the firstvirtual machine is independent and is not a dependent virtual machine,then the maximum incremental chain length may be set to a maximum lengthof 500 snapshots.

In one embodiment, the maximum incremental chain length for the snapshotchain may be determined based on an age of the backed-up versions withinthe snapshot chain. In one example, the maximum incremental chain lengthfor a snapshot chain storing versions of the first virtual machine thatare less than one year old may comprise a maximum incremental chainlength of 100 incrementals, while the maximum incremental chain lengthfor a snapshot chain storing versions of the first virtual machine thatare more than one year old may comprise a maximum incremental chainlength of 200 incrementals.

In step 338, it is determined whether a new snapshot chain should becreated based on the maximum incremental chain length. In step 340, atype of snapshot to be stored for the first virtual machine isdetermined based on the maximum incremental chain length. The type ofsnapshot may comprise either a full image snapshot or an incrementalsnapshot. In one embodiment, if the snapshot chain for the first virtualmachine exceeds the maximum incremental chain length for the snapshotchain, then the type of snapshot to be stored for the first virtualmachine may comprise a full image snapshot. In this case, an additionalsnapshot chain may be created for the first virtual machine.

In some embodiments, the number of snapshots in a snapshot chain maydecrease over time as older versions of a virtual machine areconsolidated, archived, deleted, or moved to a different storage domain(e.g., to cloud storage) depending on the data backup and archivingschedule for the virtual machine. In some cases, the maximum incrementalchain length or the maximum number of snapshots for a snapshot chain maybe increased over time as the versions stored by the snapshot chain age.In one example, if the versions of a virtual machine stored using asnapshot chain are all less than one month old, then the maximumincremental chain length may be set to a maximum of 200 incrementals;however, if the versions of the virtual machine stored using thesnapshot chain are all greater than one month old, then the maximumincremental chain length may be set to a maximum of 1000 incrementals.

FIG. 3C is a flowchart describing one embodiment of a process forrestoring a version of a virtual machine using a data storage system. Inone embodiment, the process of FIG. 3C may be performed by a storageappliance, such as storage appliance 170 in FIG. 1A.

In step 382, a particular version of a virtual machine to be restored isidentified. In step 384, a base image from which the particular versionmay be derived is determined. In step 386, a set of incremental filesfor generating the particular version is determined. In one embodiment,the base image and the set of incremental files may be determined from amerged file associated with the particular version of the virtualmachine. In some cases, the set of incremental files may include one ormore forward incremental files and/or one or more reverse incrementalfiles. In step 388, a file associated with the particular version isgenerated using the base image and the set of incremental files. Thefile may be generated by patching the set of incremental files onto thebase image. In step 390, at least a portion of the file is outputted.The at least a portion of the file may be electronically transferred toa computing device, such as computing device 154 in FIG. 1A, or to avirtualization manager, such as virtualization manager 169 in FIG. 1A.

In some embodiments, the base image and a subset of the set ofincremental files may correspond with a second virtual machine differentfrom the virtual machine. In this case, the base image may comprise thebase image for the second virtual machine and the set of incrementalfiles may include a dependent base file that comprises data differencesbetween the base image for the second virtual machine and a previouslyacquired base image for the virtual machine.

FIG. 4A depicts one embodiment of a data storage node 430 running aplurality of database engines including database engines DB Engines432-435. The data storage node 430 may correspond with node 141 in FIG.1D. The database engines executed by the data storage node 430 maycorrespond with the same database application or different databaseapplications. In one example, DB Engine 432 may comprise a firststructured query language (SQL) server (e.g., SQL Server 2016), DBEngine 433 may comprise a second SQL server (e.g., SQL Server 2017), andDB Engine 434 may comprise an open source database application. Acompatibility level associated with the first SQL server may besupported by the second SQL server. In one example, the DB Engine 433may be used to generate synthetic snapshots for databases comprising SQLServer 2017 and SQL Server 2016 while the DB Engine 432 may be used togenerate synthetic snapshots only for databases comprising SQL Server2016. A database engine scheduler running on the data storage node 430may instantiate database engines of a particular type (e.g., running aparticular open source database application) and terminate the databaseengines over time based on the estimated need for the database enginesand/or the number of synthetic snapshots scheduled to be generated bythe data storage node 430. The database engine scheduler may manage asynthetic snapshot job queue for each of the database engines and assignsynthetic snapshot jobs to the job queues based on queue lengths for thejob queues and the particular types of database engines running on thedata storage node. If the job queue lengths for job queues associatedwith a particular type of database engine (e.g., each comprising thesame open source database application) have all exceeded a thresholdqueue length, then the database engine scheduler may instantiate one ormore new database engines of the particular type. In some cases, thedatabase engine scheduler may stagger the generation of syntheticsnapshots in order to manage the job queue lengths for the syntheticsnapshot job queues.

FIG. 4B depicts one embodiment of a server 420 in communication with adata storage node 430. The database transaction logs and databasesnapshots generated by the server 420 may be transferred to the datastorage node 430 and synthetic snapshots may be generated by the datastorage node 430 using the transferred database transaction logs and thedatabase snapshots. The server 420 may correspond with server 160 inFIG. 1A and the data storage node 430 may correspond with node 141 inFIG. 1D. The server 420 may run a database not depicted and transfer afirst snapshot 412 corresponding with a state of the database at time t1and a second snapshot 414 corresponding with a state of the database attime t6 to data storage node 430. The first snapshot 412 and the secondsnapshot 414 may be transferred to the data storage node 430 in responseto a request for snapshots of the database at times t1 and t6. In oneexample, the snapshot 412 may correspond with a state of the database at2 pm and the snapshot 414 may correspond with a state of the database at4 pm; although hourly snapshots of the database may be required tosatisfy a data backup policy or an RPO for the database, the databasemay have been unable to provide a database snapshot at time t4 (e.g., at3 pm). In this case, the data storage node 430 may be required togenerate a synthetic snapshot 413 in order to satisfy the data backuppolicy.

As depicted in FIG. 4B, the server 420 may also transfer databasetransaction logs 422-425 for the database to the data storage node 430over time. In one example, database transaction logs for the databasemay be transferred to the data storage node 430 every five minutes orevery minute. The database transaction logs (or log files) 422 maycomprise one or more transaction logs (e.g., 50 log files) that includedata changes that have occurred to the database between times t0 and t2.The log files 423 may comprise one or more transaction logs that includedata changes that have occurred to the database between times t2 and t3.The log files 424 may comprise one or more transaction logs that includedata changes that have occurred to the database between times t3 and t5.The log files 425 may comprise one or more transaction logs that includedata changes that have occurred to the database between times t5 and t7.Metadata within the database transaction logs may be used to align thelog files with various points in time. For example, metadata associatedwith or stored within log files 422 may specify when the data changesstored within the log files 422 occurred between 1:52 pm and 2:12 pm. Inone embodiment, the data storage node 430 may generate the syntheticsnapshot 413 by accessing snapshot 412 stored within the data storagenode 430, accessing log files 422-424 stored within the data storagenode 430, determining data changes that occurred to the database fromtime t1 to time t4 using the log files 422-424, and generating thesynthetic snapshot 413 by applying the data changes that occurred to thedatabase between times t1 and t4 to the snapshot 412.

FIG. 4C depicts one embodiment of files used by one or more databaseengines to generate one or more synthetic snapshots. As depicted,database transaction log files 452-454, snapshot 442, and snapshot 446may be acquired by a data storage node, such as data storage node 430 inFIG. 4B, from a server, such as server 420 in FIG. 4B. The snapshot 442may comprise a snapshot of a database at time t1 and snapshot 446 maycomprise a snapshot of the database at time t5. The log files 452 maycomprise a plurality of transaction logs associated with data changesmade to the database occurring between times t1 and t2. The log files453 may comprise a plurality of transaction logs associated with datachanges made to the database occurring between times t2 and t3. The logfiles 454 may comprise a plurality of transaction logs associated withdata changes made to the database occurring between times t3 and t4.

As depicted in FIG. 4C, a first database engine DB Engine 432 may beinstantiated or executed by a data storage node to generate syntheticsnapshot 443 and synthetic snapshot 444. To generate the syntheticsnapshot 443, the first database engine DB Engine 432 may acquire thesnapshot 442 transferred to and stored within the data storage node,acquire database transaction log files 452, and generate the syntheticsnapshot 443 by applying the log files 452 to the snapshot 442. Togenerate the synthetic snapshot 444, the first database engine DB Engine432 may acquire database transaction log files 453 and generate thesynthetic snapshot 444 by applying the log files 453 to the syntheticsnapshot 443. After the two synthetic snapshots have been generated, thedata storage node may terminate the first database engine DB Engine 432.The data storage node may instantiate or execute a second databaseengine DB Engine 434 to generate synthetic snapshot 445. To generate thesynthetic snapshot 445, the second database engine DB Engine 434 mayacquire database transaction log files 454 and generate the syntheticsnapshot 445 by applying the log files 454 to the synthetic snapshot444. The data storage node may instantiate and/or terminate databaseengines over time in order to conserve power and compute resources andto reduce costs associated with executing the database engines. In someembodiments, the data storage node (or a cluster of data storage nodes)may detect that a snapshot of the database at time t2 cannot be obtainedfrom a server running the database and in response identify a databaseengine among a pool of database engines or instantiate the databaseengine in order to generate the synthetic snapshot 443 comprising asnapshot of the database at time t2.

In some embodiments, although an SLA policy or a data backup policy fora database may require database snapshots to be captured every 24 hours,a storage appliance may generate and store synthetic snapshots everyhour (and without intervention by the server hosting the database) inorder to improve the recovery time required to recover a particularversion of the database. In this case, at most one hour of transactionlogs will need to be applied to one of the synthetic snapshots in orderto recover the particular version of the database.

FIG. 5A is a flowchart describing one embodiment of a process forgenerating and storing synthetic snapshots. In one embodiment, theprocess of FIG. 5A may be performed by a storage appliance, such asstorage appliance 170 or storage appliance 140 in FIG. 1A. The processof FIG. 5A may be performed by a data storage node, such as data storagenode 141 in FIG. 1D.

In step 502, a first snapshot of a database at a first point in time isacquired from a server. The first snapshot of the database may begenerated by the server, such as server 420 in FIG. 4B and may beacquired by a data storage node, such as node 430 in FIG. 4B. In step504, the first snapshot of the database is stored. The first snapshotmay be stored within a non-volatile memory of the data storage node. Instep 506, it is determined that a second snapshot of the database at asecond point in time subsequent to the first point in time should beacquired from the server. In one embodiment, a data backup policy mayrequire that snapshots of the database be captured on a periodic basis(e.g., every hour) and the second snapshot of the database maycorrespond with the next hourly snapshot of the database.

In step 508, it is detected that the server is unable to provide thesecond snapshot of the database at the second point in time. In somecases, a data storage node may detect that the database is unable toprovide the second snapshot of the database at the second point in timeif the database or the server running the database denies a request forthe second snapshot, the database fails to provide the second snapshotwithin a threshold period of time from a request for the second snapshot(e.g., the database fails to provide the second snapshot within fiveminutes from the request), or if the second point in time is during ablackout window for the database. In some cases, a lookup table ofblackout time periods during which database snapshots cannot berequested from the database may be used by the data storage node todetermine whether the server is unable to provide the second snapshot ofthe database at the second point in time. In step 510, it is determinedwhether a database engine is available to generate the second snapshotof the database at the second point in time. In one embodiment, upondetection that the server is unable to provide the second snapshot ofthe database, a data storage node may generate a synthetic snapshotcorresponding with a state of the database at the second point in timeusing the database engine. The data storage node may determine that thedatabase engine is available to generate a second snapshot if a databaseengine among a pool of database engines managed by the data storage nodeis available or the database engine has a queue length for runningsynthetic snapshot jobs less than a threshold queue length (e.g., thesynthetic snapshot job queue has less than three jobs).

In step 512, the database engine is instantiated in response todetecting that the server is unable to provide the second snapshot ofthe database at the second point in time. In step 514, one or moretransaction logs for the database that include a set of data changes tothe database between the first point in time and the second point intime are acquired. The one or more transaction logs for the database maybe acquired and stored on a periodic basis from the server. In step 516,the second snapshot of the database is generated via application of theset of data changes to the first snapshot of the database using thedatabase engine. In step 518, the second snapshot of the database isstored. The second snapshot of the database may be generated by the datastorage node and stored as a synthetic snapshot of the database at thesecond point in time.

FIG. 5B is a flowchart describing another embodiment of a process forgenerating and storing synthetic snapshots. In one embodiment, theprocess of FIG. 5B may be performed by a storage appliance, such asstorage appliance 170 or storage appliance 140 in FIG. 1A. The processof FIG. 5B may be performed by a data storage node, such as data storagenode 147 in FIG. 1D.

In step 532, a snapshot frequency for capturing snapshots of a databasefrom a server is determined. The snapshot frequency may be set dependingon a recovery point objective for the database or a data backup policyfor the database (e.g., specifying that database snapshots should becaptured every hour). In step 534, a first snapshot of the database at afirst point in time is acquired from the server. The first snapshot ofthe database may be stored using non-volatile memory within a datastorage node. In step 536, it is detected that a number of data changesthat occurred to the database since the first point in time is greaterthan a threshold number of data changes. In one example, a data storagenode may detect that a date change rate associated with the databasesince the first point in time is greater than a threshold data changerate. In another example, a data storage node may detect that anaggregate file size for one or more transaction logs associated with thedata changes that occurred to the database since the first point in timeis greater than a threshold file size (e.g., the aggregate file size isgreater than 10 TB). The data storage node may compute the aggregatefile size as the one or more transaction logs are received from theserver and stored within the data storage node on a periodic basis.

In step 538, it is detected that a second point in time correspondingwith a second snapshot of the database is more than a threshold amountof time in the future based on the snapshot frequency. In one example,the first point in time corresponding with the first snapshot of thedatabase may comprise 1:00 pm and the second point in time correspondingwith the second snapshot of the database may comprise 2:00 pm; if thethreshold amount of time is ten minutes, then if it is detected prior to1:50 pm that the number of data changes that occurred to the databasesince the first point in time is greater than the threshold number ofdata changes, then the data storage node may generate a syntheticsnapshot for the database even though the snapshot frequency does notrequire it. One benefit of generating the synthetic snapshotcorresponding with a point in time prior to the second point in time isthat the recovery time for the database may be improved.

In step 540, it is detected that a synthetic snapshot of the databaseshould be generated in response to detection that the number of datachanges that occurred to the database since the first point in time isgreater than the threshold number of data changes. In step 542, adatabase engine within a pool of database engines is identified. In oneexample, the database engine may comprise the database engine among thepool of database engines with the smallest job queue length forgenerating synthetic snapshots. In step 544, one or more transactionlogs for the database that include data changes to the databasesubsequent to the first point in time and prior to the second point intime are acquired. In step 546, the synthetic snapshot is generated viaapplication of the data changes to the database subsequent to the firstpoint in time and prior to the second point in time to the firstsnapshot using the database engine. The database engine may load thefirst snapshot of the database and then apply the data changes to thedatabase that occurred subsequent to the first point in time. In step548, the synthetic snapshot is stored. After the synthetic snapshot hasbeen generated by the data storage node, the data storage node mayterminate the database engine.

One embodiment of the disclosed technology includes acquiring a firstsnapshot of a database at a first point in time from a server executingthe database, detecting that the server is unable to provide a secondsnapshot of the database at a second point in time subsequent to thefirst point in time, acquiring one or more transaction logs for thedatabase that include a set of data changes to the database between thefirst point in time and the second point in time, instantiating orexecuting a database engine within a cluster of data storage nodes inresponse to detecting that the server is unable to provide the secondsnapshot of the database at the second point in time, generating thesecond snapshot of the database via application of the set of datachanges to the first snapshot of the database using the database engine,terminating the database engine from the cluster of data storage nodes,and storing the second snapshot of the database within the cluster ofdata storage nodes.

One embodiment of the disclosed technology includes a memory incommunication with one or more processors. The one or more processorsand memory may be part of a data storage node within a cluster of datastorage nodes. The one or more processors configured to acquire a firstsnapshot of a database at a first point in time from a server executingthe database and detect that the server is unable to provide a secondsnapshot of the database at a second point in time subsequent to thefirst point in time. The one or more processors configured to acquireone or more transaction logs for the database that include a set of datachanges to the database between the first point in time and the secondpoint in time and instantiate a database engine in response to detectionthat the server is unable to provide the second snapshot of the databaseat the second point in time. The one or more processors configured togenerate the second snapshot of the database via application of the setof data changes to the first snapshot of the database using the databaseengine and terminate the database engine. The one or more processorsconfigured to store the second snapshot of the database using thememory.

One embodiment of the disclosed technology includes determining asnapshot frequency for capturing snapshots of a database from a server,acquiring a first snapshot of the database at a first point in time fromthe server, detecting that a number of data changes that have occurredto the database since the first point in time is greater than athreshold number of data changes, detecting that a second point in timecorresponding with a second snapshot of the database is more than athreshold amount of time in the future based on the snapshot frequency,detecting that a synthetic snapshot of the database should be generatedin response to detecting that the number of data changes that haveoccurred to the database since the first point in time is greater thanthe threshold number of data changes and detecting that the second pointin time corresponding with the second snapshot of the database is morethan the threshold amount of time in the future, identifying a databaseengine to generate the synthetic snapshot for the database, acquiringone or more transaction logs for the database that include a set of datachanges to the database subsequent to the first point in time and priorto the second point in time, generating the synthetic snapshot viaapplication of the set of data changes to the database to the firstsnapshot using the database engine, and storing the synthetic snapshot.

The disclosed technology may be described in the context ofcomputer-executable instructions, such as software or program modules,being executed by a computer or processor. The computer-executableinstructions may comprise portions of computer program code, routines,programs, objects, software components, data structures, or other typesof computer-related structures that may be used to perform processesusing a computer. In some cases, hardware or combinations of hardwareand software may be substituted for software or used in place ofsoftware.

Computer program code used for implementing various operations oraspects of the disclosed technology may be developed using one or moreprogramming languages, including an object oriented programming languagesuch as Java or C++, a procedural programming language such as the “C”programming language or Visual Basic, or a dynamic programming languagesuch as Python or JavaScript. In some cases, computer program code ormachine-level instructions derived from the computer program code mayexecute entirely on an end user's computer, partly on an end user'scomputer, partly on an end user's computer and partly on a remotecomputer, or entirely on a remote computer or server.

For purposes of this document, it should be noted that the dimensions ofthe various features depicted in the Figures may not necessarily bedrawn to scale.

For purposes of this document, reference in the specification to “anembodiment,” “one embodiment,” “some embodiments,” or “anotherembodiment” may be used to describe different embodiments and do notnecessarily refer to the same embodiment.

For purposes of this document, a connection may be a direct connectionor an indirect connection (e.g., via another part). In some cases, whenan element is referred to as being connected or coupled to anotherelement, the element may be directly connected to the other element orindirectly connected to the other element via intervening elements. Whenan element is referred to as being directly connected to anotherelement, then there are no intervening elements between the element andthe other element.

For purposes of this document, the term “based on” may be read as “basedat least in part on.”

For purposes of this document, without additional context, use ofnumerical terms such as a “first” object, a “second” object, and a“third” object may not imply an ordering of objects, but may instead beused for identification purposes to identify different objects.

For purposes of this document, the term “set” of objects may refer to a“set” of one or more of the objects.

Although the subject matter has been described in language specific tostructural features and/or methodological acts, it is to be understoodthat the subject matter defined in the appended claims is notnecessarily limited to the specific features or acts described above.Rather, the specific features and acts described above are disclosed asexample forms of implementing the claims.

What is claimed is:
 1. A method for operating a data management system,comprising: acquiring a first snapshot of a database at a first point intime from a server executing the database; detecting that the server isunable to provide a second snapshot of the database at a second point intime subsequent to the first point in time; acquiring one or moretransaction logs for the database that include a set of data changes tothe database between the first point in time and the second point intime; instantiating a database engine within a cluster of data storagenodes in response to detecting that the server is unable to provide thesecond snapshot of the database at the second point in time; generatingthe second snapshot of the database via application of the set of datachanges to the first snapshot of the database using the database engine;terminating the database engine from the cluster of data storage nodes;and storing the second snapshot of the database within the cluster ofdata storage nodes.
 2. The method of claim 1, wherein: the detectingthat the server is unable to provide the second snapshot of the databaseincludes detecting that the server has failed to provide the secondsnapshot of the database within a threshold period of time from arequest for the second snapshot of the database transmitted to theserver.
 3. The method of claim 1, wherein: the detecting that the serveris unable to provide the second snapshot of the database includesdetermining a blackout window for the database in which snapshotacquisition from the database is prohibited and detecting that thesecond point in time is during the blackout window for the database. 4.The method of claim 1, further comprising: determining a compatibilitylevel for the database; and determining the database engine based on thecompatibility level for the database.
 5. The method of claim 1, furthercomprising: detecting that the server is unable to provide a thirdsnapshot of the database at a third point in time subsequent to thesecond point in time; acquiring one or more additional transaction logsfor the database that include a second set of data changes to thedatabase between the second point in time and the third point in time;and generating the third snapshot of the database using the second setof data changes and the second snapshot of the database using thedatabase engine.
 6. The method of claim 1, wherein: the one or moretransaction logs for the database comprise a plurality of databasetransaction logs.
 7. The method of claim 1, wherein: the storing thesecond snapshot of the database includes storing the second snapshot asan incremental snapshot.
 8. The method of claim 1, wherein: the databasecomprises a relational database.
 9. The method of claim 1, furthercomprising: detecting that a number of updates to the database betweenthe first point in time and the second point in time has exceeded athreshold number of updates; and outputting an alert specifying that adatabase anomaly has been detected.
 10. A data management system,comprising: a memory; and one or more processors configured to acquire afirst snapshot of a database at a first point in time from a serverexecuting the database and detect that the server is unable to provide asecond snapshot of the database at a second point in time subsequent tothe first point in time, the one or more processors configured toacquire one or more transaction logs for the database that include a setof data changes to the database between the first point in time and thesecond point in time and instantiate a database engine in response todetection that the server is unable to provide the second snapshot ofthe database at the second point in time, the one or more processorsconfigured to generate the second snapshot of the database viaapplication of the set of data changes to the first snapshot of thedatabase using the database engine and terminate the database engine,the one or more processors configured to store the second snapshot ofthe database using the memory.
 11. The data management system of claim10, wherein: the one or more processors configured to detect that theserver has failed to provide the second snapshot of the database withina threshold period of time from a request for the second snapshot of thedatabase transmitted to the server.
 12. The data management system ofclaim 10, wherein: the one or more processors configured to determine ablackout window for the database in which snapshot acquisition from thedatabase is prohibited and detect that the second point in time isduring the blackout window for the database.
 13. The data managementsystem of claim 10, wherein: the one or more processors configured todetermine a compatibility level for the database and determine thedatabase engine based on the compatibility level for the database. 14.The data management system of claim 10, wherein: the one or moreprocessors configured to detect that the server is unable to provide athird snapshot of the database at a third point in time subsequent tothe second point in time and acquire one or more additional transactionlogs for the database that include a second set of data changes to thedatabase between the second point in time and the third point in time,the one or more processors configured to generate the third snapshot ofthe database using the second set of data changes and the secondsnapshot of the database using the database engine.
 15. The datamanagement system of claim 10, wherein: the one or more transaction logsfor the database comprise a plurality of database transaction logs. 16.The data management system of claim 10, wherein: the second snapshot isstored as a full image snapshot.
 17. The data management system of claim10, wherein: the database comprises a non-relational database.
 18. Amethod for operating a data management system, comprising: determining asnapshot frequency for capturing snapshots of a database from a server;acquiring a first snapshot of the database at a first point in time fromthe server; detecting that a number of data changes that have occurredto the database since the first point in time is greater than athreshold number of data changes; detecting that a second point in timecorresponding with a second snapshot of the database is more than athreshold amount of time in the future based on the snapshot frequency;detecting that a synthetic snapshot of the database should be generatedin response to detecting that the number of data changes that haveoccurred to the database since the first point in time is greater thanthe threshold number of data changes and detecting that the second pointin time corresponding with the second snapshot of the database is morethan the threshold amount of time in the future; identifying a databaseengine to generate the synthetic snapshot for the database; acquiringone or more transaction logs for the database that include a set of datachanges to the database subsequent to the first point in time and priorto the second point in time; generating the synthetic snapshot viaapplication of the set of data changes to the database to the firstsnapshot using the database engine; and storing the synthetic snapshot.19. The method of claim 18, wherein: the one or more transaction logsare acquired from the server at a frequency that is higher than thesnapshot frequency for the database.
 20. The method of claim 18,wherein: the detecting that the number of data changes that haveoccurred to the database since the first point in time is greater thanthe threshold number of data changes includes detecting that anaggregate file size for the one or more transaction logs is greater thana threshold file size.